Distributed denial-of-service (DDoS) is a rapidly growing problem. The multitude and variety of both the attacks and the defense approaches is overwhelming. This paper presents two taxonomies for classifying attacks and defenses, and thus provides researchers with a better understanding of the problem and the current solution space. The attack classification criteria was selected to highlight commonalities and important features of attack strategies, that define challenges and dictate the design of countermeasures. The defense taxonomy classifies the body of existing DDoS defenses based on their design decisions; it then shows how these decisions dictate the advantages and deficiencies of proposed solutions.

/pdf/a-taxonomy-of-ddos-attack-and-ddos-defense-mechanisms-3fjlj0hhjy.pdf

A taxonomy of DDoS attack and DDoS defense mechanisms

The Transmission Control Protocol.

We report on the design and implementation of the Privacy Integrated Queries (PINQ) platform for privacy-preserving data analysis. PINQ provides analysts with a programming interface to unscrubbed data through a SQL-like language. At the same time, the design of PINQ's analysis language and its careful implementation provide formal guarantees of differential privacy for any and all uses of the platform. PINQ's unconditional structural guarantees require no trust placed in the expertise or diligence of the analysts, substantially broadening the scope for design and deployment of privacy-preserving data analysis, especially by non-experts.

/pdf/privacy-integrated-queries-an-extensible-platform-for-36s2soxejh.pdf

Privacy integrated queries: an extensible platform for privacy-preserving data analysis

The Mirai botnet, composed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile targets with massive distributed denial-of-service (DDoS) attacks. In this paper, we provide a seven-month retrospective analysis of Mirai's growth to a peak of 600k infections and a history of its DDoS victims. By combining a variety of measurement perspectives, we analyze how the botnet emerged, what classes of devices were affected, and how Mirai variants evolved and competed for vulnerable hosts. Our measurements serve as a lens into the fragile ecosystem of IoT devices. We argue that Mirai may represent a sea change in the evolutionary development of botnets--the simplicity through which devices were infected and its precipitous growth, demonstrate that novice malicious techniques can compromise enough low-end devices to threaten even some of the best-defended targets. To address this risk, we recommend technical and nontechnical interventions, as well as propose future research directions.

https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-antonakakis.pdf

Understanding the mirai botnet

Distributed Denial of Service (DDoS) flooding attacks are one of the biggest concerns for security professionals. DDoS flooding attacks are typically explicit attempts to disrupt legitimate users' access to services. Attackers usually gain access to a large number of computers by exploiting their vulnerabilities to set up attack armies (i.e., Botnets). Once an attack army has been set up, an attacker can invoke a coordinated, large-scale attack against one or more targets. Developing a comprehensive defense mechanism against identified and anticipated DDoS flooding attacks is a desired goal of the intrusion detection and prevention research community. However, the development of such a mechanism requires a comprehensive understanding of the problem and the techniques that have been used thus far in preventing, detecting, and responding to various DDoS flooding attacks. In this paper, we explore the scope of the DDoS flooding attack problem and attempts to combat it. We categorize the DDoS flooding attacks and classify existing countermeasures based on where and when they prevent, detect, and respond to the DDoS flooding attacks. Moreover, we highlight the need for a comprehensive distributed and collaborative defense approach. Our primary intention for this work is to stimulate the research community into developing creative, effective, efficient, and comprehensive prevention, detection, and response mechanisms that address the DDoS flooding problem before, during and after an actual attack.

/pdf/a-survey-of-defense-mechanisms-against-distributed-denial-of-36i5dbdzy6.pdf

A Survey of Defense Mechanisms Against Distributed Denial of Service (DDoS) Flooding Attacks

AIMS
Our understanding of dedifferentiated endometrial carcinoma (DEC), a rare and aggressive malignancy, mainly reflects undifferentiated carcinomas (UC) arising in the setting of low-grade endometrial cancer (DEC-LG). However, cases of UC arising in the setting of high-grade EC (DEC-HG) have been noted in the literature. Our knowledge of the genomics of DEC-HG is limited. To characterise the molecular landscape of DEC-HC, targeted genomic sequencing and immunohistochemical analysis was carried out on seven DEC-HG and four DEC-LG.


METHODS AND RESULTS
DEC-HG and DEC-LG, including undifferentiated and differentiated components, both showed a similar frequency and spectrum of mutations. ARID1A mutations were identified in 6/7 (86%) DEC-HG and 4/4 (100%) DEC-LG, while SMARCA4 mutations were present in 4/7 (57%) DEC-HG and in 1/4 (25%) DEC-LG. Concurrent SMARCA4/BRG1 protein loss by immunohistochemistry was observed in 3/4 and 1/1 SMARCA4 mutated DEC-HG and DEC-LG, respectively. Neither genomic alterations nor protein loss in SMARCB1/INI1 were observed in any of our cases. TP53 mutations were detected in 4/7 (57%) DEC-HG and in 2/4 (50%) DEC-LG, while mutation-pattern p53 immunohistochemistry expression was observed in 2/7 (29%) DEC-HG and none of the DEC-LG. MLH1 mutations were observed in 1/7 (14%) DEC-HG and 1/4 (25%) DEC-LG. MSH2 and MSH6 mutations were each detected in 1/7 (14%) DEC-HG, but neither was associated with corresponding loss of protein expression.


CONCLUSION
The findings support expanding the definition of DEC to include DEC-HG, a previously under-recognised phenomenon with genomic similarities to DEC-LG.

https://onlinelibrary.wiley.com/doi/pdfdirect/10.1111/his.14938

Genomic profiling of dedifferentiated endometrial carcinomas arising in the background of high-grade carcinoma: a targeted next-generation sequencing study.

Many network testbeds today allow users to create their own disk images as a way of saving experimental state between allocations. We examine the effect of this practice on testbed operations. We find that disk imaging is very popular among both research and class users. Excessive disk image creation makes OS upgrades and patches time-demanding, leading over time to experiments that use old and vulnerable images. Since older images are not supported on new testbed hardware this hurts users by reducing their chance of successful resource allocation. Finally, disk images are usually large requiring excessive storage space on testbeds.

We then propose and evaluate three alternatives to disk imaging. We find that each approach significantly reduces storage requirements, and produces a list of OS image customizations that may help testbed users upgrade their images to newer OS versions. While this would still be a very manual process, we believe our results show promise and identify need for further research in this area.

/pdf/beyond-disk-imaging-for-preserving-user-state-in-network-4c6kz8g6sp.pdf

Beyond disk imaging for preserving user state in network testbeds

Network operators and system administrators are increasingly overwhelmed with incessant cyber-security threats ranging from malicious network reconnaissance to attacks such as distributed denial of service and data breaches. A large number of these attacks could be prevented if the network operators were better equipped with threat intelligence information that would allow them to block or throttle nefarious scanning activities. Network telescopes or"darknets"offer a unique window into observing Internet-wide scanners and other malicious entities, and they could offer early warning signals to operators that would be critical for infrastructure protection and/or attack mitigation. A network telescope consists of unused or"dark"IP spaces that serve no users, and solely passively observes any Internet traffic destined to the"telescope sensor"in an attempt to record ubiquitous network scanners, malware that forage for vulnerable devices, and other dubious activities. Hence, monitoring network telescopes for timely detection of coordinated and heavy scanning activities is an important, albeit challenging, task. The challenges mainly arise due to the non-stationarity and the dynamic nature of Internet traffic and, more importantly, the fact that one needs to monitor high-dimensional signals (e.g., all TCP/UDP ports) to search for"sparse"anomalies. We propose statistical methods to address both challenges in an efficient and"online"manner; our work is validated both with synthetic data as well as real-world data from a large network telescope.

Detection of Sparse Anomalies in High-Dimensional Network Telescope Signals

The Domain Name System (DNS) is part of critical internet infrastructure, as DNS is invoked whenever a remote server is accessed (an URL is visited, an API request is made, etc.) by any application. DNS queries are served in hierarchical manner, with most queries served locally from cached data, and a small fraction propagating to the top of the hierarchy – DNS root name servers. Our research aims to provide a comprehensive, longitudinal characterization of DNS queries received at B-Root over ten years. We sampled and analyzed a 28-billion-query large dataset from the ten annual "Day in the Life of the Internet (DITL)" experiments, from 2013 through 2022. We sought to identify and quantify unexpected DNS queries, establish longitudinal trends, and compare our findings with published results of others. We found that unexpected query traffic increased from 39.57% in 2013 to 67.91% in 2022, with 36.55% of queries being priming queries. We also observed growth and decline of Chromium-initiated, random DNS queries. Finally, we analyzed the largest DNS query senders and established that most of their traffic consists of unexpected queries.

Jelena Mirkovic

Papers

Genomic profiling of dedifferentiated endometrial carcinomas arising in the background of high-grade carcinoma: a targeted next-generation sequencing study.

Beyond disk imaging for preserving user state in network testbeds

Detection of Sparse Anomalies in High-Dimensional Network Telescope Signals

Understanding DNS Query Composition at B-Root

Guest Editorial: Security of Communication Protocols in Industrial Control Systems (ICSs)